Do i need to use App password if I'm using OAuth authentication with VS code and bitbucket?

Damien Chow

 

I'm using VS code for GIT over https to Bitbucket.

 

My current setup is using the Atlassian for VS Code extension

https://support.atlassian.com/bitbucket-cloud/docs/get-started-with-vs-code/

 

Via the extension, I can Login to Bitbucket Cloud. This is via the OAuth authorization page in my browser. In the browser, I am logged in to my Atlassian account.

Recently, I received the following message when I performed Git push to my repo through VS Code terminal.

 

You are using an account password for Git over HTTPS.
remote: Beginning March 1, 2022, users are required to use app passwords
remote: for Git over HTTPS.
remote: To avoid any disruptions, change the password used in your Git client
remote: to an app password.
remote: Note, these credentials may have been automatically stored in your Git client
remote: and/or a credential manager such as Git Credential Manager (GCM).

 

Do I need to make a change to an App password if I'm using the OAuth authorization mechanism to login to my bitbucket repo?

 

I've tried to follow the instructions in the link below and I have created an App password. But I can't find the login screen to enter my App password under the Atlassian for VS Code extension

 

https://bitbucket.org/blog/deprecating-atlassian-account-password-for-bitbucket-api-and-git-activity

 

Please assist. 

 

David Dansby

Hi Damien,

My name is David and I'm an engineer on the Bitbucket Cloud team. 

When you are using your terminal in VCS you are not actually using the VSCode version control system (VCS) extension/plugin system that VSCode uses (and for which you authenticated in the OAuth authentication page to integrate with Bitbucket Cloud).

The terminal you are using in VSCode is virtually the same terminal as you would typically use on your computer (it uses a terminal emulator). So, given the fact that you are receiving that terminal messaging, that means you are using your account password for authentication.

If you instead use the specific VSCode Version Control System functionality as detailed in their documentation then you shouldn't have an issue because your authenticated via the OAuth page as you stated. Furthermore, you won't be impacted by the March 1, 2022 date when we remove account password usage for Basic authentication with Git over HTTPS. 

However, you will still see this error message and be impacted by this change when you are using Git over HTTPS in your terminal (regardless of which terminal you using).

Can you please tell me if you are prompted to enter your password when you push/pull your code to Bitbucket Cloud from the terminal? I imagine you are not seeing the terminal prompt you for your password for authentication because typically a lot of OS systems store your credentials after the first successful use of the password for that specific Git remote URL. 

If you are using a Mac then your password is being stored in its credential manager, OS X Keychain. Windows does something similar with Windows Credential Manager. To determine what credential manager Git is using to store credentials/password you can follow use the steps in the Cause section of the following Bitbucket knowledge base post: 

https://confluence.atlassian.com/bbkb/why-am-i-not-prompted-for-password-when-pushing-or-pulling-to-my-repositories-in-bitbucket-cloud-via-https-800293400.html#:~:text=The%20most%20likely%20reason%20for,c)%20for%20a%20specific%20repository.

Once you determine where your credentials are being stored you can do 1 of 2 things:

1. This is the step I personally prefer: determine where your credentials are being stored in the Cause section of the link I provided above,
   1. Remove those stored credentials.
   2. In this case, the next time you go to push/pull to Bitbucket Cloud from your terminal again you will be prompted to enter your password.
   3. Enter your new app password and then the credential manager Git is using should store this app password
   4. Next time you push/pull you should no longer see the error messaging and will not be impacted the change on March 1, 2022
2. I personally do not prefer this because then you have to enter your password every single time you push/pull: use the Resolution section in the support link I provided above
   1. Unset the credential manager Git uses.
   2. Next time you push/pull your terminal will prompt you to enter your password. 
   3. Enter your app password going forward to avoid seeing the error message, and importantly to avoid being impacted by the change on March 1, 2022 going foward

Please let us know if you have any issues or other questions.

Happy coding,

David Dansby